Add Flatpak bundle to the release workflow

Builds carrier-x86_64.flatpak from the linux job's already-built binary
rather than recompiling inside flatpak-builder's sandbox (which can't
see the shared cargo cache anyway, making an in-sandbox build pure
duplicate work). com.randogoth.carrier.release.json is a separate
manifest from the main one, which stays as-is for local
`devbox run package` dev-from-source builds.

.forgejo/workflows/release.yml

@@ -69,6 +69,35 @@ jobs:
           name: carrier-linux-x86_64
           path: carrier/target/release/carrier-linux-x86_64
 
+  # Packages the linux job's already-built binary instead of recompiling
+  # inside flatpak-builder's own sandbox: that sandbox copies the source
+  # tree in fresh, so it never sees ~/.cargo/registry or target/, making an
+  # in-sandbox cargo build fully redundant with the linux job's build.
+  # com.randogoth.carrier.release.json (not the main manifest, which is
+  # still used by local `devbox run package` for from-source dev builds)
+  # just installs this prebuilt binary instead of invoking cargo.
+  flatpak:
+    needs: [linux]
+    runs-on: linux-x86_64
+    steps:
+      - uses: https://code.forgejo.org/actions/checkout@v4
+        with:
+          path: carrier
+      - uses: https://code.forgejo.org/forgejo/download-artifact@v7
+        with:
+          name: carrier-linux-x86_64
+          path: carrier
+      - run: chmod +x carrier-linux-x86_64
+        working-directory: carrier
+      - run: devbox run bundle-flatpak
+        working-directory: carrier
+        env:
+          GITHUB_TOKEN: ""
+      - uses: https://code.forgejo.org/forgejo/upload-artifact@v5
+        with:
+          name: carrier-x86_64.flatpak
+          path: carrier/carrier-x86_64.flatpak
+
   # forgejo-release.sh (the engine behind actions/forgejo-release) always
   # does a blind create-then-upload of the release for the tag, with no
   # check for one already existing - running it from two parallel jobs
@@ -78,7 +107,7 @@ jobs:
   # produce artifacts; exactly one job, gated on both finishing, does the
   # single release create + upload.
   release:
-    needs: [macos, linux]
+    needs: [macos, linux, flatpak]
     runs-on: linux-x86_64
     steps:
       - uses: https://code.forgejo.org/forgejo/download-artifact@v7